I've found in the forum a nice way to query the metadata tables to check if our servers are writing logs,
the search term I'm using:
| metadata type=hosts index=distrib | eval mytime=strftime (recentTime, "%y-%m-%d %H:%M:%S") | eval currentTime=strftime(now(), "%y-%m-%d %H:%M:%S") | eval minutesAgo=round(((now()-recentTime)/60),0) | table sourcetype,host,lastTime,source,recentTime,mytime,currentTime,minutesAgo | where (abs(minutesAgo) > 1)
which works great, but when I'm using it as a report, the generated report gives
the current time as 70-01-01 02:00:00.
The TimeRange configured is
start time: rt-1m
finish time: rt
(I've tried some other time variations, but always got the same result)
(btw we're using Splunk 6)
Can you provide any help on the subject?
Did the trick 🙂
Use time() instead of now(). The latter gives you the time the search was launched, and can be trouble in certain constellations. Using time() will also self-update the timestamp over the potentially long-running realtime search.